Aes-ctr

Go cryptography 2025 updates: post-quantum key exchange via ML-KEM in TLS/SSH, native FIPS 140-3 module, a clean security audit, and broader library improvements that affect compliance and future-proofing.

DuckDB 1.4 adds on-disk encryption (AES-GCM-256/CTR-256) with key derivation, WAL and temporary-file encryption, and near-zero OpenSSL-backed performance impact, but it is not yet aligned with NIST standards.